CVE-2023-22488: Flarum Core - Flarum notifications can leak restricted content
Summary
CVE-2023-22488: Flarum notifications can leak restricted content. Affects flarum/core versions < 1.6.3. Fixed in 1.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flarum is an open-source forum software built with PHP and Laravel. It provides a platform for online discussions and community interactions. The Flarum notifications feature allows users to receive alerts and updates about various activities within the forum. However, a vulnerability in this feature can lead to the leakage of restricted content, bypassing access controls and potentially exposing sensitive information to unauthorized users.
Vulnerability Detail
The vulnerability in Flarum notifications arises from a lack of proper access checks. When sending notifications, the system does not verify if the content being notified can be seen by the recipient. As a result, notifications are sent through different channels, including emails, even for restricted or private content. While the alerts themselves do not reveal the data due to visibility checks, emails are still sent out, potentially exposing the content to unintended recipients. This flaw allows actors to bypass content restrictions imposed by extensions, such as the Subscriptions extension, by subscribing to discussions before they become private. The impact of this vulnerability includes the leaking of posts awaiting approval, posts in tags inaccessible to the user, and posts restricted by third-party extensions. Other notification subjects may also lead to similar leaks if specific types of notifications for restricted content are allowed.
How To Fix
Minimum fixed version
1.6.3
This is the first release that contains the fix.
composer require flarum/core:1.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to Flarum version 1.6.3 is not immediately feasible, a workaround is to disable the Flarum Subscriptions extension or disable email notifications altogether. However, it is important to note that these workarounds may impact the functionality and user experience of the forum.
Conclusion
The Flarum notifications vulnerability (CVE-2023-22488) can lead to the leakage of restricted content in the forum database. It is crucial for Flarum users to upgrade to version 1.6.3 or apply the provided workarounds to mitigate the risk. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for flarum/core →
FAQ
Flarum is an open-source forum software built with PHP and Laravel. It provides a platform for online discussions and community interactions.
The vulnerability allows the leaking of restricted content in the forum database, including posts awaiting approval, posts in inaccessible tags, and posts restricted by third-party extensions.
The vulnerability has been fixed in Flarum version 1.6.3. Upgrading to this version is recommended. Instructions for the upgrade can be found in the 'how_to_fix' section of this report.
If upgrading to Flarum version 1.6.3 is not immediately possible, a workaround is to disable the Flarum Subscriptions extension or disable email notifications.
For more information, you can visit the Flarum community forum at https://discuss.flarum.org/. If you have specific support questions, you can create a discussion at https://discuss.flarum.org/t/support.
References
Related vulnerabilities
Recent vulnerabilities recorded for flarum/core.
